Detectionlowtest

New Service Creation Using PowerShell

Detects the creation of a new service using powershell.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Timur Zinniatullin, Daniil Yugoslavskiy, oscd.communityCreated Mon Feb 20c02e96b7-c63a-4c47-bd83-4a9f74afcfb2windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains|all:
            - 'New-Service'
            - '-BinaryPathName'
    condition: selection

False Positives

Legitimate administrator or user creates a service for legitimate reasons.

Software installation

References

MITRE ATT&CK

Tactics

Sub-techniques

Related Rules

New Service Creation Using Sc.EXE

Detects the creation of a new service using the "sc.exe" utility.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

c02e96b7-c63a-4c47-bd83-4a9f74afcfb2

Status

test

Level

low

Type

Detection

Created

Mon Feb 20

Author

Path

rules/windows/process_creation/proc_creation_win_powershell_create_service.yml

Raw Tags

attack.persistenceattack.privilege-escalationattack.t1543.003